Skip to main content
Enterprise deployment is the standard OpenWork Enterprise binary plus an optional MDM push of one configuration file. There is no customer-specific installer build, no wrapping, and no repackaging — the signed release artifacts are never modified, so normal macOS and Windows signature verification is preserved.

​
The enterprise binary

OpenWork ships a dedicated enterprise distribution alongside the public one. Both are published on GitHub Releases; enterprise artifacts follow the enterprise update channel. The enterprise distribution differs from the public build in ways that are baked into the package metadata at build time — not toggled by configuration:
  • The product is named OpenWork Enterprise.
  • Sign-in is always required.
  • Activation is always required: before an administrator-provisioned activation completes, the app exposes only the minimal surface needed to accept a connect link and read or write its bootstrap configuration. Chat, tools, and workspace access stay locked.
  • Auto-update follows the enterprise release channel, so enterprise installs never pick up public-channel artifacts.
A packaged public build can never be turned into an enterprise build with environment variables or configuration files; the distribution flavor is read only from immutable package metadata.

​
Optional MDM push: desktop-bootstrap.json

If you manage the fleet with MDM (Jamf, Intune, or similar), distribute the enterprise binary the way you distribute any other app, and optionally write one JSON file during provisioning so the first launch already knows your Den server:
Deployment details worth knowing:
  • Older builds read a legacy ~/.config/openwork path on every OS. Current builds still read it for compatibility; the newest writtenAt decides which file applies.
  • Clearing cloud configuration in the app removes bootstrap files entirely, so a fresh MDM-dropped config wins on the next launch.
  • OPENWORK_DESKTOP_BOOTSTRAP_PATH points a machine at an isolated bootstrap file for testing; legacy global configuration never crosses that boundary.

​
What you do not push through MDM

  • Activation. The app writes enterpriseActivation into desktop-bootstrap.json only after a signed activation claim verifies. Do not provision this record yourself; a hand-written entry is not proof of a provisioned tenant, and the app treats it as incomplete.
  • Certificates. The desktop builds its trust bundle from the OS trust stores — Windows machine and user Root/CA stores, and the macOS administrator-controlled System keychains. Deploy enterprise CAs the way you already do; no OpenWork-specific certificate file exists. See Certificate trust and proxies.
  • Desktop policies. Version pinning and feature policies are delivered by your Den server after sign-in and enforced by the app automatically — no MDM scripting. Manage them in the organization dashboard.
Both paths end at the same place: normal organization sign-in against your Den deployment. For fully isolated networks, combine this page with the Air-gapped deployment checklist — with MDM distribution, installer bytes never need to transit Den at all.